Skip to content

Commit ea62906

Browse files
Merge pull request #287012 from tarTech23/wmi
Changes to WMI flow
2 parents 21f8d65 + 63211a6 commit ea62906

File tree

1 file changed

+11
-14
lines changed

1 file changed

+11
-14
lines changed

articles/defender-for-iot/organizations/detect-windows-endpoints-script.md

Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,9 @@ Before performing the procedures in this article, you must have:
4141
The script described in this article is supported for the following Windows operating systems:
4242

4343
- Windows XP
44-
- Windows 2000
45-
- Windows NT
4644
- Windows 7
4745
- Windows 10
48-
- Windows Server 2003/2008/2012/2016/2019
46+
- Windows Server 2003/2008/2012
4947

5048
## Download and run the script
5149

@@ -55,26 +53,25 @@ The script detects enriched Windows data, and is run as a utility and not an ins
5553

5654
1. Sign into your OT sensor console, and select **System Settings** > **Import Settings** > **Windows Information**.
5755

58-
1. Select **Download script**. For example:
56+
1. Select **Download script**. Your browser might ask you if you want to keep the file, select **Keep** or any similar options.
5957

6058
:::image type="content" source="media/detect-windows-endpoints-script/download-wmi-script.png" alt-text="Screenshot of where to download WMI script." lightbox="media/detect-windows-endpoints-script/download-wmi-script.png":::
6159

62-
1. Copy the script to a local drive and unzip it. The following files appear:
60+
1. Copy the file to a local drive and unzip it. The following file appears:
6361

64-
- `start.bat`
65-
- `settings.json`
66-
- `data.bin`
67-
- `run.bat`
62+
- `Extract_system_info.bat`
6863

69-
1. Run the `run.bat` file.
64+
1. Run the `Extract_system_info.bat` file.
7065

71-
After the script runs to probe the registry, a CX-snapshot file appears with the registry information. The filename indicates the machine name and the current date and time of the snapshot with the following syntax: `cx_snapshot_[machinename]_[current date time]`.
66+
1. You'll be asked whether you want to display errors on screen or not. Make you own selection.
7267

73-
Files generated by the script include:
68+
After the script runs to probe the registry, an output file appears with the registry information. The filename indicates the current date and time of the snapshot with the following syntax: `[current date time]_system_info_extractor`.
69+
70+
Files generated by the script:
7471

7572
- Remain on the local drive until you delete them.
76-
- Must remain in the same location. Don't separate the generated files.
77-
- Are overwritten if you run the script again.
73+
- Are overwritten if you run the script again on the same day.
74+
- Include an errorOutput file that is empty if no errors occurred during the running of the script.
7875

7976
## Import device details
8077

0 commit comments

Comments
 (0)